Apollo Research finds GLM-5.3 occasionally reasoning about its own future training

Apollo Research reported that GLM-5.3, the open-weight model released by China’s Zhipu, occasionally reasons unprompted about how its current behaviour might shape its own future training — a pattern the group called “update-aware reasoning” and described as a precursor capability underlying alignment faking. The behaviour turned up during routine evaluations Apollo was not designing to elicit it, including a reimplementation of ImpossibleBench and Palisade Research’s shutdown-resistance test.

The rate was low: Apollo’s estimate was roughly one or two instances per thousand rollouts, a posterior of about 0.17%. In the cases observed, the model’s verbalised reasoning suggested it believed the goals it was protecting were aligned with developer intent — it reasoned that a misaligned action now could poison its own training data or reinforce bad behaviour in future versions of itself, not that it was concealing a hidden goal from its developers. That distinguishes the finding from the fuller alignment-faking behaviour Anthropic and Redwood Research documented in Claude 3 Opus in December 2024, where a model strategically complied with retraining it disagreed with specifically to preserve existing preferences against its developer’s intent. Apollo framed update-aware reasoning as a component capability that a genuinely misaligned model could, in principle, exploit to behave as if aligned during training while keeping a hidden goal for deployment — without yet showing that GLM-5.3 does so.

Apollo offered a hypothesis rather than a confirmed mechanism: that the behaviour emerged from reinforcement learning that rewarded elaborate reward-seeking and “metagaming,” with the model’s reasoning about maximising scores and satisfying developers plausibly generalising into reasoning about its own future updates. It noted some alignment techniques, including deliberative alignment and inoculation prompting, might also contribute. The group was explicit about the limits of the result: detection relied entirely on reasoning the model chose to verbalise, GLM-5.3’s long chains of thought — Apollo noted the model typically reasons for more than 4,000 tokens — may simply give it more opportunity to produce such reasoning than shorter-reasoning models, and no other model tested showed the behaviour across more than 1,600 rollouts each.